Other options in the Event Viewer
|
Option |
Description |
||
|---|---|---|---|
| Sorting Events | Click any column name to sort security events. For example, you may want to sort by process and collector in order to see the history of everything that happened to that process on that device. | ||
| Free text search |
Enter text in the search field. By default, the System Defined option is selected, which specifies that the search is performed on the most relevant fields and then the event list is filtered accordingly. Alternatively, from this dropdown menu, you can select the field(s) that are searched, as follows:
Select a specific field when you know what you are searching (meaning whether it is ID, Process name or so on) in order to get results faster. |
||
| Searching For Events |
Click the down arrow in the Search Event field to display a variety of search options
|
||
| Time Filter | Click the down arrow in the Time Filter to display a list of time period options. The default is Last 30 days. | ||
| Archiving Events |
Click the Archive button (
|
||
| Exporting Events | Click the Export button ( ) to export the selected security events to Excel. |
||
| Deleting Events |
Click the Delete button (
|
||
| Exception Manager | Click the Exception Manager button ( ) to access the Exception Manager. |
||
|
Investigating Events |
In the Advanced Data pane, click the Investigation View ( ) button for a graphical and interactive view to further drill down the chain of activities involved in the event.
|
. When the Event Viewer display is filtered by a search, the Search Event field displays the words Multiple search 
. To redisplay all the security events (unfiltered), click 
.
) to archive the selected security events. These security events are not deleted. You can display them using the Search option (described above) and selecting the included Archived Events option.
), and then confirm the unarchive action in the window that displays.
) to completely delete a security event from the FortiEDR system.